Google on Monday published a security bulletin describing the latest round of patches for the Android operating system. Three dozen vulnerabilities have been fixed, including a critical issue that can be exploited for remote code execution over Bluetooth.
The critical vulnerability is tracked as CVE-2022-20345 and it affects the System component. It has been patched with Android 12 and 12L updates.
According to Google, an attacker does not require additional execution privileges to remotely execute arbitrary code over a Bluetooth attack. No additional details are available about the vulnerability.
The remaining security bugs have all been assigned a ‘high severity’ rating. They impact components such as Framework, Media Framework, System, Kernel, Imagination Technologies, MediaTek, Unisoc and Qualcomm components. Many of them can lead to privilege escalation or information disclosure.
Fixes for these flaws are included in the security patch levels ‘2022-08-01’ and ‘2022-08-05’. Google releases two patch levels to provide its partners the flexibility to fix a subset of vulnerabilities that are similar across all devices more quickly. However, the tech giant advises partners to use the latest security patch level and bundle all fixes in a single update.
In its Pixel devices, Google patched 40 security holes, including four critical remote code execution issues affecting the modem component. Three of the weaknesses, which can lead to privilege escalation or information disclosure, are rated ‘high severity’, while the rest have been assigned a ‘moderate severity’ rating.
Samsung has also released updates for its flagship models to patch the Android vulnerabilities, as well as 20 flaws discovered in its own devices.
Related: 44 Vulnerabilities Patched in Android With April 2022 Security Updates
Related: Microsoft Finds Major Security Flaws in Pre-Installed Android Apps
Related: Google Patches Critical Android Vulnerabilities With June 2022 Updates
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
- Dish Ransomware Attack Impacted Nearly 300,000 People
- Samsung Smartphone Users Warned of Actively Exploited Vulnerability
Latest News
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Security Pros: Before You Do Anything, Understand Your Threat Landscape
- Major Massachusetts Health Insurer Hit by Ransomware Attack, Member Data May Be Compromised
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- Today’s Cyber Defense Challenges: Complexity and a False Sense of Security

